CVE-2026-74490
In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most queue-dump callsites already serialize that walk under the socket lock or sk->sk_lock.slock, but tipc_poll() calls trace_tipc_sk_poll(..., TIPC_DUMP_ALL, ...) without holding either lock. That lets the poll trace path reach tipc_list_dump() and backlog head/tail dumping while another context dequeues and frees an skb, leaving the trace helper dereferencing a stale queue entry. Stop the unlocked poll trace site from requesting queue dumps. Other queue dump trace callsites keep their existing output under the locking they already provide, while poll still emits the event itself without walking live queue members from an unlocked context.
Affected versions
Linux kernel versions
5.0
and later are affected. Fixed in
6.6.151,
6.12.103,
6.18.44,
7.1.8,
7.2-rc6
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-74490?
CVE-2026-74490 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.0 onward and has been patched in 6.6.151, 6.12.103, 6.18.44 and others. CVE-2026-74490 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74490?
Yes. CVE-2026-74490 has been patched. Fixed versions include 6.6.151, 6.12.103, 6.18.44 and others. If you are running Linux kernel 5.0 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74490 actively exploited?
No. CVE-2026-74490 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.